A teenager from Amman, Jordan, suspected of orchestrating high-profile data theft and extortion campaigns under the notorious banner of the ShinyHunters hacking collective, has been detained by local authorities and is reportedly cooperating with the FBI. According to investigative reporting by KrebsOnSecurity and corroborating international reports, the suspect—who uses the online handle “Rey”—was taken into custody just as the hacking group was actively attempting to extort a recently divested business unit of global aerospace giant Boeing.
The timing of the arrest and the targets involved have drawn intense international scrutiny. The aviation unit targeted by the hackers, Jeppesen ForeFlight, has personal ties to the suspect’s immediate family environment; Rey’s father reportedly works for Royal Jordanian Airlines, a carrier largely controlled by the Jordanian government that operates its long-haul passenger fleet using aircraft designed and manufactured by Boeing.
On October 3, Reuters cited three unnamed sources confirming that a suspected ShinyHunters member in Amman, identified as Saif Al-din Khader, had been detained by Jordanian law enforcement agencies and was actively assisting the FBI in identifying other members of the sprawling, decentralized cybercrime gang. KrebsOnSecurity had previously linked the handle “Rey” to Khader in a November 2025 profile, where the young man openly discussed his involvement with multiple digital extortion and ransomware operations.
Rey’s name surfaced again in late September during an exclusive report regarding Dutch police arresting 24-year-old convicted cybercriminal Pepijn van der Stap on suspicion of aiding ShinyHunters’ data thefts. Cybersecurity journalists and investigators noted that immediately following Van der Stap’s arrest on the evening of September 15, Rey assumed public control over the ShinyHunters brand. He quickly began boasting online about infiltrating high-profile targets, including the FBI, and extorting the established ransomware syndicate known as Cl0p.
Using his longtime account on Twitter/X, Rey taunted both federal law enforcement and the Cl0p ransomware operators with viral memes. Simultaneously, he embedded the distinct avatar of Van der Stap’s former hacker alias, “Umbreon,“ into his posts in an apparent, calculated attempt to frame the Dutch citizen for the ongoing wave of cyberattacks.
The digital intrusions that fueled this chaos relied heavily on the mass exploitation of a severe security vulnerability tracked as CVE-2026-35273. The flaw targeted PeopleSoft, a widely deployed enterprise software-as-a-service platform from Oracle utilized by organizations worldwide for human resources, recruitment, payroll, and benefits management. Although Oracle moved quickly to issue a security patch after ShinyHunters began exploiting the zero-day flaw in June, and security firm Mandiant released web application firewall (WAF) mitigation rules, the hackers later bypassed these defenses using well-known URL-encoding tricks.
Security researchers from Mandiant and the Google Threat Intelligence Group confirmed in a late September joint report that ShinyHunters mass-exploited the PeopleSoft vulnerability to plunder sensitive data from dozens of organizations across diverse sectors, spanning higher education, technology, healthcare, agriculture, transportation, and government agencies.
Further compounding the fallout, Reuters reported that the FBI removed an Accenture contractor over failures to properly patch the specific FBI recruitment portal compromised by ShinyHunters. That breach exposed sensitive personal and professional details of more than 5,000 FBI personnel, including their specialized units, roles, and even confidential medical and psychiatric records.
‘Rey’ Means King, as in Royal
According to sources familiar with the ongoing international investigation, the digital navigation and aviation unit divested by Boeing was precisely the target under active extortion when Jordanian authorities moved in to apprehend Rey. The FBI’s investigation into the ShinyHunters ecosystem gained substantial urgency following this specific extortion attempt, largely because the stolen data posed potential risks to operational safety and aviation security.
Boeing formally acknowledged the extortion attempts in a statement, confirming the incident involved proprietary data tied to Jeppesen ForeFlight, a subsidiary that Boeing sold in November 2025 to private equity firm Thoma Bravo for $10.55 billion. A Boeing spokesperson noted that the company was actively reviewing the matter alongside the Jeppesen ForeFlight team. Meanwhile, a spokesperson for Jeppesen ForeFlight assured investigators and customers that a thorough internal review found no operational or product impact stemming from the claims.
Rey’s alleged role in targeting the aviation sector drew heightened attention due to his family connections. Cybersecurity research into family-shared computer systems previously compromised by password-stealing malware revealed that Rey’s father utilized credentials that crossed over into multiple online employee portals for Royal Jordanian Airlines. Although neither Rey nor his father responded to multiple requests for comment from investigative journalists, digital footprints indicate that shortly after inquiries were sent, Rey began purging his social media footprint, scrubbing the accounts used to taunt law enforcement.
Despite deleting his primary social media channels, Rey’s technical blog hosted on GitHub remained active. In March 2026, the blog published a lengthy and detailed investigative post attempting to expose the true identities of two Russian men serving as the core developers and administrators behind the Cl0p ransomware operation.
Murder-for-Hire Allegations
While investigators zeroed in on the digital footprint of the young Jordanian hacker, simultaneous developments in the Netherlands brought explosive allegations against Pepijn van der Stap. Despite widespread public media coverage celebrating Van der Stap’s supposed personal transformation from a convicted cybercriminal into a reformed security professional, Dutch daily newspaper RTL reported on September 29 that investigators suspected him of attempting to orchestrate at least two murders abroad.
Van der Stap had recently completed the majority of a four-year prison sentence stemming from data theft and extortion convictions that prosecutors estimated netted between 1.5 million and 2.7 million euros. Following his release, he secured employment as an "offensive security lead" at a Dutch cybersecurity firm named Neo Security, where he claimed his primary responsibility was testing client networks for vulnerabilities.
Following a dramatic nighttime police raid on September 15 that reportedly involved the use of flash-bang grenades, Neo Security’s owner, Benjamin Korper, stated that an independent firm was hired to audit the company’s systems. Initial findings showed no evidence that Van der Stap had compromised his employer or its client base, but the severity of the parallel criminal allegations stunned the European cybersecurity community. Before his initial 2023 arrest, Van der Stap had worked as a software engineer at an Amsterdam-based security startup while volunteering with the Dutch Institute for Vulnerability Disclosure, maintaining a respectable public profile while secretly conducting widespread extortion schemes.
Franchising and Burning a Brand
The broader ShinyHunters collective has been linked to dozens of major data breaches impacting billions of records worldwide since at least 2019. However, security experts emphasize that the individuals operating under the ShinyHunters moniker today are distinct from the group’s original core members, most of whom are French citizens who have previously faced arrest and imprisonment.
Over time, ShinyHunters evolved into an informal criminal franchise—resembling the fictional "Dread Pirate Roberts" concept, where succession is driven by law enforcement arrests rather than death, allowing multiple individuals to adopt the brand simultaneously. Investigators note that federal authorities are increasingly focused on a network of freelance cybercriminals who trade stolen software credentials for a percentage of subsequent data ransoms.
In the wake of Van der Stap’s arrest, online chat rooms and Telegram channels previously operated or frequented by Rey erupted in public mockery. Commentators accused the teenager of hijacking the historical ShinyHunters brand for personal financial gain after its original leaders were dismantled by European authorities. According to cybercrime analysts, Rey allegedly acquired old PGP keys and forum assets to set up fraudulent replicas of leak sites, using the established name to shake down corporate victims and siphon a 25 to 30 percent cut of ransom negotiations.
In interviews with tech media outlets, representatives of the shifting ShinyHunters network claimed their decision to target the FBI was a calculated public relations response. They argued that the move was designed to counter official agency warnings issued in May advising organizations never to pay cyber extortionists. While the hackers asserted their intrusions demonstrated technical prowess and undermined law enforcement advisories, security analysts maintain that the aggressive public posturing ultimately accelerated the international dragnet, culminating in coordinated arrests and detentions across Europe and the Middle East.
Comments (0)